Exploiting a FCKeditOr.
What you will need:
1) Modified .htaccess (Code is below)
2) Shell in name_php.gif format
3) Site with FCKeditor
Chapter I - Collecting vulnerable site
It's easy to dork one.
Simple dork:
Code:
inurl:fckeditor intitle:Connectors Test When you found a site navigate to the:
Code:
/fckeditor/editor/filemanager/browser/default/connectors/test.html Code:
[URL='http://www.site.com/fckeditor/']http://www.site.com/fckeditor/ You add
Code:
editor/filemanager/browser/default/connectors/test.html ![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vyHLShXY8dJ7mxKMAO5Tl6CMSXeqA16iWoooXyh6n5WO4QpGzbCcjmDF9XX4Y1ELTPKJ6dLveN3pOQ8eJfGB8fsmBiyEYT6qDhelDQeZZ7SCbWhlY6ae8=s0-d)
Now here comes exploiting.
Chapter II - Exploiting
Select "PHP" from the top left drop menu and click "Get folders" if it comes up with this:
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sURA4cpvcCW0ii-xEl_N_cnUER07DdKYfIO6R2uDVD4stqfNvo2D6THihgkkrbQpzXRWRowp5lUfB_Op9qWlRUVYSYEjzy_AZqOayeQ3nEuvzMFeI6=s0-d)
It means Connector is enabled and working.
Next thing you want to do is to create a new folder.
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tcOAiDShMMBAXWRFfQmUere7CHjnVNRkcESz4PlqlohjSq0QL9kqJX0Ap7kM_DFibIjEyYUmgKirfkoe66N2lkhx51k_vw2kOcekYaX_6uPX4BEWGG=s0-d)
When you created that click on "Get folders" again to check if it exists.
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sdKA6kdkIXtj4PAtoze4fIeuKIVweWPgtaKueyXMSbmTbK2WLDbR6QTRkhFNKTovff4MofReEDYN4XQvvq98pm7XSvN4fhy5gfi3A2i5V1EfWX-Gs5Dmc=s0-d)
Open up notepad and paste you shell source in it.
Save it as shell_php.gif.
In current folder field enter your new folder (My case is tutorial-haxor) and press "Get folders" again.
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t7yBu2qCsDxEZX7Yr1gVqcFPPcn2D09_0x6UUAb6jFuQraIzyS9PITsJ4OhL9w7fRVRgLspg7JU1GWAyYhFRIDUeURw8E35AcvmdEdEnaDtthbLOdhdng=s0-d)
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vUECFpOzLh61O3IThhv9isk1adUxlbJG0D_fQNz3BZzXVoIoFBF1jHjZ37D1xmnDnEPjwff-OIveUYlUuJAUMdB3FfEju6Ej4PQ6uCLM4O-KYg-FTR=s0-d)
Now just upload .htaccess and shell_php.gif
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tXZ3SqboOBpR41FitkYnDMEvh6sOzmBxP_IluxdLIgRhG8doZqCWj2dpHW9dWWi6lj8UyLuE9eUzdvoJvpLKMJo020arSTsYT5o2eb5MvSVKbRGdv0xrA=s0-d)
Just access your shell:
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v5Cv4jQ-sJUkFeoRQzzkO8UJES8q9kjmTyA4xyEu2WSUG6WPHNRZYvQvUcj7mR6qknCpOG4wILzuTKPknpChUmLjvyGnJqDmJGUsWY7kgN3zUhkMx8=s0-d)
And thats it.
I hope you enjoyed this little tutorial.
Thanks for reading!
1) .htaccess code:
Code:
<FilesMatch "_php.gif">
SetHandler application/x-httpd-php
</FilesMatch> Tags: Fckeditor
Previous Article
Subscribe to:
Post Comments (Atom)
Share your views...
0 Respones to "Exploiting a FCKeditOr."
Post a Comment